Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4f4d7d76 authored by subrahmanyaman's avatar subrahmanyaman Committed by Subrahmanya Manikanta Venkateswarlu Bhamidipati Kameswara Sri
Browse files

Updated the vts attestation tests for strongbox implementations which 

do not support factory attestation.

Bug: 219962281
Test: Run vts tests.

(cherry picked from https://android-review.googlesource.com/q/commit:7d9bc46f6f26586492f368a877b339eee56f7ffb)
Merged-In: Ie3f3f33f773227d879e11f11e2ef0eaee33db648
Change-Id: Ie3f3f33f773227d879e11f11e2ef0eaee33db648
parent 8785f89b

security/keymint/aidl/vts/functional/AttestKeyTest.cpp

+12 −11
Original line number Diff line number Diff line
@@ -289,7 +289,8 @@ TEST_P(AttestKeyTest, RsaAttestedAttestKeys) { 
    AttestationKey attest_key;

    vector<KeyCharacteristics> attest_key_characteristics;

    vector<Certificate> attest_key_cert_chain;

    auto result = GenerateAttestKey(AuthorizationSetBuilder()

    auto result =

              GenerateAttestKey(AuthorizationSetBuilder()

                                        .RsaKey(2048, 65537)

                                        .AttestKey()

                                        .AttestationChallenge(challenge)

security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp

+24 −0
Original line number Diff line number Diff line
@@ -269,6 +269,30 @@ ErrorCode KeyMintAidlTestBase::GenerateKey(const AuthorizationSet& key_desc, 
    return GenerateKey(key_desc, attest_key, &key_blob_, &key_characteristics_, &cert_chain_);

}



ErrorCode KeyMintAidlTestBase::GenerateKeyWithSelfSignedAttestKey(

        const AuthorizationSet& attest_key_desc, const AuthorizationSet& key_desc,

        vector<uint8_t>* key_blob, vector<KeyCharacteristics>* key_characteristics,

        vector<Certificate>* cert_chain) {

    AttestationKey attest_key;

    vector<Certificate> attest_cert_chain;

    vector<KeyCharacteristics> attest_key_characteristics;

    // Generate a key with self signed attestation.

    auto error = GenerateKey(attest_key_desc, std::nullopt, &attest_key.keyBlob,

                             &attest_key_characteristics, &attest_cert_chain);

    if (error != ErrorCode::OK) {

        return error;

    }



    attest_key.issuerSubjectName = make_name_from_str("Android Keystore Key");

    // Generate a key, by passing the above self signed attestation key as attest key.

    error = GenerateKey(key_desc, attest_key, key_blob, key_characteristics, cert_chain);

    if (error == ErrorCode::OK) {

        // Append the attest_cert_chain to the attested cert_chain to yield a valid cert chain.

        cert_chain->push_back(attest_cert_chain[0]);

    }

    return error;

}



ErrorCode KeyMintAidlTestBase::ImportKey(const AuthorizationSet& key_desc, KeyFormat format,

                                         const string& key_material, vector<uint8_t>* key_blob,

                                         vector<KeyCharacteristics>* key_characteristics) {

security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h

+15 −0
Original line number Diff line number Diff line
@@ -93,6 +93,21 @@ class KeyMintAidlTestBase : public ::testing::TestWithParam<string> { 
    ErrorCode GenerateKey(const AuthorizationSet& key_desc,

                          const optional<AttestationKey>& attest_key = std::nullopt);



    // Generate key for implementations which do not support factory attestation.

    ErrorCode GenerateKeyWithSelfSignedAttestKey(const AuthorizationSet& attest_key_desc,

                                                 const AuthorizationSet& key_desc,

                                                 vector<uint8_t>* key_blob,

                                                 vector<KeyCharacteristics>* key_characteristics,

                                                 vector<Certificate>* cert_chain);



    ErrorCode GenerateKeyWithSelfSignedAttestKey(const AuthorizationSet& attest_key_desc,

                                                 const AuthorizationSet& key_desc,

                                                 vector<uint8_t>* key_blob,

                                                 vector<KeyCharacteristics>* key_characteristics) {

        return GenerateKeyWithSelfSignedAttestKey(attest_key_desc, key_desc, key_blob,

                                                  key_characteristics, &cert_chain_);

    }



    ErrorCode ImportKey(const AuthorizationSet& key_desc, KeyFormat format,

                        const string& key_material, vector<uint8_t>* key_blob,

                        vector<KeyCharacteristics>* key_characteristics);

security/keymint/aidl/vts/functional/KeyMintTest.cpp

+186 −94
Original line number Diff line number Diff line
@@ -902,7 +902,7 @@ TEST_P(NewKeyGenerationTest, RsaWithAttestation) { 
    for (auto key_size : ValidKeySizes(Algorithm::RSA)) {

        vector<uint8_t> key_blob;

        vector<KeyCharacteristics> key_characteristics;

        auto result = GenerateKey(AuthorizationSetBuilder()

        auto builder = AuthorizationSetBuilder()

                               .RsaSigningKey(key_size, 65537)

                               .Digest(Digest::NONE)

                               .Padding(PaddingMode::NONE)
@@ -911,13 +911,21 @@ TEST_P(NewKeyGenerationTest, RsaWithAttestation) { 
                               .Authorization(TAG_NO_AUTH_REQUIRED)

                               .Authorization(TAG_CERTIFICATE_SERIAL, serial_blob)

                               .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)

                                          .SetDefaultValidity(),

                                  &key_blob, &key_characteristics);

                               .SetDefaultValidity();



        auto result = GenerateKey(builder, &key_blob, &key_characteristics);

        // Strongbox may not support factory provisioned attestation key.

        if (SecLevel() == SecurityLevel::STRONGBOX) {

            if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) return;

            if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) {

                result = GenerateKeyWithSelfSignedAttestKey(

                        AuthorizationSetBuilder()

                                .RsaKey(key_size, 65537)

                                .AttestKey()

                                .SetDefaultValidity(), /* attest key params */

                        builder, &key_blob, &key_characteristics);

            }



        }

        ASSERT_EQ(ErrorCode::OK, result);

        ASSERT_GT(key_blob.size(), 0U);

        CheckBaseParams(key_characteristics);

        CheckCharacteristics(key_blob, key_characteristics);
@@ -1038,7 +1046,7 @@ TEST_P(NewKeyGenerationTest, RsaEncryptionWithAttestation) { 


    vector<uint8_t> key_blob;

    vector<KeyCharacteristics> key_characteristics;

    auto result = GenerateKey(AuthorizationSetBuilder()

    auto builder = AuthorizationSetBuilder()

                           .RsaEncryptionKey(key_size, 65537)

                           .Padding(PaddingMode::NONE)

                           .AttestationChallenge(challenge)
@@ -1046,11 +1054,19 @@ TEST_P(NewKeyGenerationTest, RsaEncryptionWithAttestation) { 
                           .Authorization(TAG_NO_AUTH_REQUIRED)

                           .Authorization(TAG_CERTIFICATE_SERIAL, serial_blob)

                           .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)

                                      .SetDefaultValidity(),

                              &key_blob, &key_characteristics);

                           .SetDefaultValidity();



    auto result = GenerateKey(builder, &key_blob, &key_characteristics);

    // Strongbox may not support factory provisioned attestation key.

    if (SecLevel() == SecurityLevel::STRONGBOX) {

        if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) return;

        if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) {

            result = GenerateKeyWithSelfSignedAttestKey(

                    AuthorizationSetBuilder()

                            .RsaKey(key_size, 65537)

                            .AttestKey()

                            .SetDefaultValidity(), /* attest key params */

                    builder, &key_blob, &key_characteristics);

        }

    }

    ASSERT_EQ(ErrorCode::OK, result);
@@ -1154,17 +1170,25 @@ TEST_P(NewKeyGenerationTest, RsaWithAttestationMissAppId) { 
    vector<uint8_t> key_blob;

    vector<KeyCharacteristics> key_characteristics;



    auto result = GenerateKey(AuthorizationSetBuilder()

    auto builder = AuthorizationSetBuilder()

                           .RsaSigningKey(2048, 65537)

                           .Digest(Digest::NONE)

                           .Padding(PaddingMode::NONE)

                           .AttestationChallenge(challenge)

                           .Authorization(TAG_NO_AUTH_REQUIRED)

                                      .SetDefaultValidity(),

                              &key_blob, &key_characteristics);

                           .SetDefaultValidity();



    auto result = GenerateKey(builder, &key_blob, &key_characteristics);

    // Strongbox may not support factory provisioned attestation key.

    if (SecLevel() == SecurityLevel::STRONGBOX) {

        if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) return;

        if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) {

            result = GenerateKeyWithSelfSignedAttestKey(

                    AuthorizationSetBuilder()

                            .RsaKey(2048, 65537)

                            .AttestKey()

                            .SetDefaultValidity(), /* attest key params */

                    builder, &key_blob, &key_characteristics);

        }

    }

    ASSERT_EQ(ErrorCode::ATTESTATION_APPLICATION_ID_MISSING, result);

}
@@ -1276,7 +1300,7 @@ TEST_P(NewKeyGenerationTest, LimitedUsageRsaWithAttestation) { 
    for (auto key_size : ValidKeySizes(Algorithm::RSA)) {

        vector<uint8_t> key_blob;

        vector<KeyCharacteristics> key_characteristics;

        auto result = GenerateKey(AuthorizationSetBuilder()

        auto builder = AuthorizationSetBuilder()

                               .RsaSigningKey(key_size, 65537)

                               .Digest(Digest::NONE)

                               .Padding(PaddingMode::NONE)
@@ -1286,11 +1310,19 @@ TEST_P(NewKeyGenerationTest, LimitedUsageRsaWithAttestation) { 
                               .Authorization(TAG_USAGE_COUNT_LIMIT, 1)

                               .Authorization(TAG_CERTIFICATE_SERIAL, serial_blob)

                               .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)

                                          .SetDefaultValidity(),

                                  &key_blob, &key_characteristics);

                               .SetDefaultValidity();



        auto result = GenerateKey(builder, &key_blob, &key_characteristics);

        // Strongbox may not support factory provisioned attestation key.

        if (SecLevel() == SecurityLevel::STRONGBOX) {

            if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) return;

            if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) {

                result = GenerateKeyWithSelfSignedAttestKey(

                        AuthorizationSetBuilder()

                                .RsaKey(key_size, 65537)

                                .AttestKey()

                                .SetDefaultValidity(), /* attest key params */

                        builder, &key_blob, &key_characteristics);

            }

        }

        ASSERT_EQ(ErrorCode::OK, result);
@@ -1423,7 +1455,7 @@ TEST_P(NewKeyGenerationTest, EcdsaAttestation) { 
    for (auto curve : ValidCurves()) {

        vector<uint8_t> key_blob;

        vector<KeyCharacteristics> key_characteristics;

        auto result = GenerateKey(AuthorizationSetBuilder()

        auto builder = AuthorizationSetBuilder()

                               .Authorization(TAG_NO_AUTH_REQUIRED)

                               .EcdsaSigningKey(curve)

                               .Digest(Digest::NONE)
@@ -1431,11 +1463,19 @@ TEST_P(NewKeyGenerationTest, EcdsaAttestation) { 
                               .AttestationApplicationId(app_id)

                               .Authorization(TAG_CERTIFICATE_SERIAL, serial_blob)

                               .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)

                                          .SetDefaultValidity(),

                                  &key_blob, &key_characteristics);

                               .SetDefaultValidity();



        auto result = GenerateKey(builder, &key_blob, &key_characteristics);

        // Strongbox may not support factory provisioned attestation key.

        if (SecLevel() == SecurityLevel::STRONGBOX) {

            if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) return;

            if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) {

                result = GenerateKeyWithSelfSignedAttestKey(

                        AuthorizationSetBuilder()

                                .EcdsaKey(curve)

                                .AttestKey()

                                .SetDefaultValidity(), /* attest key params */

                        builder, &key_blob, &key_characteristics);

            }

        }

        ASSERT_EQ(ErrorCode::OK, result);

        ASSERT_GT(key_blob.size(), 0U);
@@ -1516,7 +1556,14 @@ TEST_P(NewKeyGenerationTest, EcdsaAttestationTags) { 
        }

        // Strongbox may not support factory provisioned attestation key.

        if (SecLevel() == SecurityLevel::STRONGBOX) {

            if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) return;

            if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) {

                result = GenerateKeyWithSelfSignedAttestKey(

                        AuthorizationSetBuilder()

                                .EcdsaKey(EcCurve::P_256)

                                .AttestKey()

                                .SetDefaultValidity(), /* attest key params */

                        builder, &key_blob, &key_characteristics);

            }

        }

        ASSERT_EQ(result, ErrorCode::OK);

        ASSERT_GT(key_blob.size(), 0U);
@@ -1567,8 +1614,20 @@ TEST_P(NewKeyGenerationTest, EcdsaAttestationTags) { 
                        .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)

                        .SetDefaultValidity();

        builder.push_back(tag);

        ASSERT_EQ(ErrorCode::CANNOT_ATTEST_IDS,

                  GenerateKey(builder, &key_blob, &key_characteristics));



        auto error = GenerateKey(builder, &key_blob, &key_characteristics);

        // Strongbox may not support factory provisioned attestation key.

        if (SecLevel() == SecurityLevel::STRONGBOX) {

            if (error == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) {

                error = GenerateKeyWithSelfSignedAttestKey(

                        AuthorizationSetBuilder()

                                .EcdsaKey(EcCurve::P_256)

                                .AttestKey()

                                .SetDefaultValidity(), /* attest key params */

                        builder, &key_blob, &key_characteristics);

            }

        }

        ASSERT_EQ(error, ErrorCode::CANNOT_ATTEST_IDS);

    }

}
@@ -1592,7 +1651,7 @@ TEST_P(NewKeyGenerationTest, EcdsaAttestationTagNoApplicationId) { 
    // to confirm that this field never makes it into the attestation extension.

    vector<uint8_t> key_blob;

    vector<KeyCharacteristics> key_characteristics;

    auto result = GenerateKey(AuthorizationSetBuilder()

    auto builder = AuthorizationSetBuilder()

                           .Authorization(TAG_NO_AUTH_REQUIRED)

                           .EcdsaSigningKey(EcCurve::P_256)

                           .Digest(Digest::NONE)
@@ -1602,11 +1661,19 @@ TEST_P(NewKeyGenerationTest, EcdsaAttestationTagNoApplicationId) { 
                           .Authorization(TAG_APPLICATION_DATA, "appdata")

                           .Authorization(TAG_CERTIFICATE_SERIAL, serial_blob)

                           .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)

                                      .SetDefaultValidity(),

                              &key_blob, &key_characteristics);

                           .SetDefaultValidity();



    auto result = GenerateKey(builder, &key_blob, &key_characteristics);

    // Strongbox may not support factory provisioned attestation key.

    if (SecLevel() == SecurityLevel::STRONGBOX) {

        if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) return;

        if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) {

            result = GenerateKeyWithSelfSignedAttestKey(

                    AuthorizationSetBuilder()

                            .EcdsaKey(EcCurve::P_256)

                            .AttestKey()

                            .SetDefaultValidity(), /* attest key params */

                    builder, &key_blob, &key_characteristics);

        }

    }

    ASSERT_EQ(result, ErrorCode::OK);

    ASSERT_GT(key_blob.size(), 0U);
@@ -1685,16 +1752,23 @@ TEST_P(NewKeyGenerationTest, EcdsaAttestationRequireAppId) { 
    auto challenge = "hello";

    vector<uint8_t> key_blob;

    vector<KeyCharacteristics> key_characteristics;



    auto result = GenerateKey(AuthorizationSetBuilder()

    auto builder = AuthorizationSetBuilder()

                           .EcdsaSigningKey(EcCurve::P_256)

                           .Digest(Digest::NONE)

                           .AttestationChallenge(challenge)

                                      .SetDefaultValidity(),

                              &key_blob, &key_characteristics);

                           .SetDefaultValidity();



    auto result = GenerateKey(builder, &key_blob, &key_characteristics);

    // Strongbox may not support factory provisioned attestation key.

    if (SecLevel() == SecurityLevel::STRONGBOX) {

        if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) return;

        if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) {

            result = GenerateKeyWithSelfSignedAttestKey(

                    AuthorizationSetBuilder()

                            .EcdsaKey(EcCurve::P_256)

                            .AttestKey()

                            .SetDefaultValidity(), /* attest key params */

                    builder, &key_blob, &key_characteristics);

        }

    }

    ASSERT_EQ(ErrorCode::ATTESTATION_APPLICATION_ID_MISSING, result);

}
@@ -1753,17 +1827,25 @@ TEST_P(NewKeyGenerationTest, AttestationApplicationIDLengthProperlyEncoded) { 
        const string app_id(length, 'a');

        vector<uint8_t> key_blob;

        vector<KeyCharacteristics> key_characteristics;

        auto result = GenerateKey(AuthorizationSetBuilder()

        auto builder = AuthorizationSetBuilder()

                               .Authorization(TAG_NO_AUTH_REQUIRED)

                               .EcdsaSigningKey(EcCurve::P_256)

                               .Digest(Digest::NONE)

                               .AttestationChallenge(challenge)

                               .AttestationApplicationId(app_id)

                                          .SetDefaultValidity(),

                                  &key_blob, &key_characteristics);

                               .SetDefaultValidity();



        auto result = GenerateKey(builder, &key_blob, &key_characteristics);

        // Strongbox may not support factory provisioned attestation key.

        if (SecLevel() == SecurityLevel::STRONGBOX) {

            if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) return;

            if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) {

                result = GenerateKeyWithSelfSignedAttestKey(

                        AuthorizationSetBuilder()

                                .EcdsaKey(EcCurve::P_256)

                                .AttestKey()

                                .SetDefaultValidity(), /* attest key params */

                        builder, &key_blob, &key_characteristics);

            }

        }

        ASSERT_EQ(ErrorCode::OK, result);

        ASSERT_GT(key_blob.size(), 0U);
@@ -6409,17 +6491,27 @@ TEST_P(KeyAgreementTest, Ecdh) { 


            // Generate EC key in KeyMint (only access to public key material)

            vector<uint8_t> challenge = {0x41, 0x42};

            EXPECT_EQ(

                    ErrorCode::OK,

                    GenerateKey(AuthorizationSetBuilder()

            auto builder = AuthorizationSetBuilder()

                                        .Authorization(TAG_NO_AUTH_REQUIRED)

                                        .Authorization(TAG_EC_CURVE, curve)

                                        .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)

                                        .Authorization(TAG_ALGORITHM, Algorithm::EC)

                                        .Authorization(TAG_ATTESTATION_APPLICATION_ID, {0x61, 0x62})

                                        .Authorization(TAG_ATTESTATION_CHALLENGE, challenge)

                                        .SetDefaultValidity()))

                    << "Failed to generate key";

                                        .SetDefaultValidity();



            ErrorCode result = GenerateKey(builder);

            if (SecLevel() == SecurityLevel::STRONGBOX) {

                if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) {

                    result = GenerateKeyWithSelfSignedAttestKey(

                            AuthorizationSetBuilder()

                                    .EcdsaKey(EcCurve::P_256)

                                    .AttestKey()

                                    .SetDefaultValidity(), /* attest key params */

                            builder, &key_blob_, &key_characteristics_, &cert_chain_);

                }

            }

            ASSERT_EQ(ErrorCode::OK, result) << "Failed to generate key";

            ASSERT_GT(cert_chain_.size(), 0);

            X509_Ptr kmKeyCert(parse_cert_blob(cert_chain_[0].encodedCertificate));

            ASSERT_NE(kmKeyCert, nullptr);